CVE-2026-47243: Kata Containers Privilege Escalation Flaw

CVE-2026-47243 Overview

CVE-2026-47243 is a guest-root to host-root escape in Kata Containers, an open source runtime that executes containers inside lightweight virtual machines. Versions prior to 3.31.0 are affected when using the runtime-rs standalone virtio-fs path. In this configuration, the host virtiofsd daemon runs as root with --sandbox none --seccomp none, granting a compromised guest a direct route to the host filesystem. An attacker with root inside the guest submits raw Filesystem in Userspace (FUSE) requests to the host daemon and creates arbitrary symlinks outside the shared directory. The flaw is categorized under [CWE-22] (Path Traversal) and is fixed in Kata Containers 3.31.0.

Critical Impact
Guest root can execute arbitrary code as host root, breaking the Kata isolation boundary that separates tenant workloads from the underlying host.

Affected Products

Kata Containers versions prior to 3.31.0
Deployments using the runtime-rs standalone virtio-fs configuration
Host environments running virtiofsd as root with --sandbox none --seccomp none

Discovery Timeline

2026-08-07 - CVE-2026-47243 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-47243

Vulnerability Analysis

Kata Containers uses virtio-fs to share directories between the host and the guest VM. In the vulnerable runtime-rs standalone configuration, the host virtiofsd daemon runs as root without a mount namespace sandbox and without seccomp filtering. This means the daemon trusts FUSE requests coming from the guest and performs filesystem operations with full host root privileges. The guest kernel normally translates VFS operations into FUSE requests through a trusted virtio-fs client, so path validation is applied on the guest side rather than on the host.

The vulnerability arises because a root user inside the guest can bypass the guest client entirely. By taking over the virtio-fs PCI device and constructing a virtqueue in userspace, the attacker sends crafted FUSE opcodes directly to virtiofsd. A FUSE_SYMLINK request supplying an absolute host path as the symlink target is honored outside the configured shared directory, enabling the creation of root-owned symlinks anywhere on the host.

Root Cause

The root cause is insufficient path validation of the symlink target within virtiofsd combined with an insecure runtime configuration that removes the mount namespace and seccomp defenses. The daemon assumes the guest kernel will constrain paths, but the guest is fully controlled by the attacker.

Attack Vector

Exploitation is local to the guest and requires root inside the VM. The attacker unbinds the virtio-fs PCI device from the guest kernel driver, drives the virtqueue from userspace, and issues a FUSE_SYMLINK request whose target is an absolute host path such as /etc/cron.d/payload. The symlink then points to a guest-controlled crontab file reachable through a live runtime process's mount namespace. When the host cron daemon reads the cron directory, it executes the payload as host root.

See the GitHub Security Advisory GHSA-2gv2-cffp-j227 for the maintainers' technical description.

Detection Methods for CVE-2026-47243

Indicators of Compromise

New or unexpected symlinks in sensitive host directories such as /etc/cron.d, /etc/cron.hourly, or /etc/sudoers.d created by the virtiofsd process
virtiofsd process performing symlinkat or symlink syscalls with targets resolving outside the configured shared directory
Host cron executing binaries or scripts whose path resolves into a container runtime mount namespace under /run/kata-containers or /var/lib/kata-containers

Detection Strategies

Audit host filesystem for symlinks in privileged directories whose owner is root but whose creation time correlates with active Kata guest workloads.
Enable Linux audit rules on symlink, symlinkat, and writes to /etc/cron.*, filtered by the virtiofsd executable path.
Monitor for guest processes unbinding the virtio-fs PCI device or accessing /dev/vfio and /sys/bus/pci/drivers/virtio-pci/unbind.

Monitoring Recommendations

Alert on any virtiofsd child or peer process spawning shells or writing outside the shared directory tree.
Track cron daemon executions of binaries located under container runtime state directories.
Log Kata runtime-rs configuration changes, particularly flags related to virtiofsd sandboxing and seccomp.

How to Mitigate CVE-2026-47243

Immediate Actions Required

Upgrade Kata Containers to version 3.31.0 or later on all host nodes running the runtime-rs standalone virtio-fs path.
Inventory all cluster nodes to identify hosts running affected versions and prioritize multi-tenant environments.
Restrict guest root access where possible and treat any guest compromise as a potential host compromise until patched.

Patch Information

The issue is fixed in Kata Containers 3.31.0. The upstream fix and full technical writeup are available in the GitHub Security Advisory GHSA-2gv2-cffp-j227 and the Openwall oss-security post.

Workarounds

Reconfigure virtiofsd to run with --sandbox=chroot or the namespace sandbox, and enable seccomp filtering rather than --seccomp none.
Run virtiofsd as a non-root user with a restricted mount namespace scoped to the shared directory.
Disable the runtime-rs standalone virtio-fs path and use an alternative sharing mechanism until upgrading is possible.

bash

# Configuration example: verify installed Kata version and virtiofsd flags
kata-runtime --version
ps -eo pid,user,cmd | grep virtiofsd
# Ensure virtiofsd is NOT launched with: --sandbox none --seccomp none
# Recommended sandbox flag when running as root:
#   virtiofsd --sandbox=chroot --seccomp=kill --shared-dir <path>